Data Processing Agreement

Last Updated: February 24, 2026 Effective Date: February 24, 2026

Company Information

Legal Entity: CMG FRAMEWORKS SRL Registered Address: Drumul NISIPOASA, Nr. 46-52, Lot 1/2, Bl. C, Scara C7, Etaj P, Ap. 3, București, Romania Contact Phone: +40 772 125 155 Email: support@cmgworkflow.com Data Protection Officer: dpo@cmgworkflow.com Supervisory Authority: ANSPDCP (Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal)

---

This Data Processing Agreement ("DPA") forms part of the Terms of Service ("Agreement") between CMG FRAMEWORKS SRL ("Processor," "we," "us," or "our") and the Customer ("Controller," "you," or "your") who has agreed to the Terms of Service, to reflect the parties' agreement with regard to the processing of personal data in accordance with the requirements of Data Protection Laws, in particular the EU General Data Protection Regulation (GDPR) - Regulation (EU) 2016/679.

This DPA is entered into pursuant to Article 28 of the GDPR and shall be binding on both parties.

---

1. Definitions

For the purposes of this DPA, the following terms shall have the meanings set out below. Terms not defined herein shall have the meanings given to them in the GDPR or the Agreement.

| Term | Definition | |------|------------| | Controller | The Customer who determines the purposes and means of the processing of personal data through the Service. The Customer subscribes to and uses the CRM platform as the entity deciding what data to collect and how it is used. | | Processor | CMG FRAMEWORKS SRL, which processes personal data on behalf of the Controller in the course of providing the Service. | | Sub-Processor | Any third party engaged by the Processor to process personal data on behalf of the Controller. | | Personal Data | Any information relating to an identified or identifiable natural person ("Data Subject"), as defined in Article 4(1) of the GDPR. | | Processing | Any operation or set of operations performed on personal data, whether or not by automated means, including collection, recording, organization, structuring, storage, adaptation, alteration, retrieval, consultation, use, disclosure by transmission, dissemination, alignment, combination, restriction, erasure, or destruction, as defined in Article 4(2) of the GDPR. | | Data Subject | An identified or identifiable natural person whose personal data is processed under this DPA. | | Personal Data Breach | A breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, personal data transmitted, stored, or otherwise processed, as defined in Article 4(12) of the GDPR. | | Data Protection Laws | The GDPR, Romanian Data Protection Law 190/2018, the ePrivacy Directive (2002/58/EC), and any other applicable data protection legislation. | | Standard Contractual Clauses (SCCs) | The standard contractual clauses for the transfer of personal data to third countries adopted by the European Commission pursuant to Decision (EU) 2021/914. | | Technical and Organizational Measures (TOMs) | The security measures described in Annex 2 of this DPA, implemented to ensure a level of security appropriate to the risk of processing. |

---

2. Roles and Responsibilities

2.1 Controller Role

The Customer acts as the Data Controller. The Controller determines the purposes and means of processing personal data through the Service, including:

• What personal data is collected and imported into the Service
• The legal basis for processing each category of data
• How long personal data is retained
• Who within the organization has access to the data
• What communications are sent to data subjects

2.2 Processor Role

CMG FRAMEWORKS SRL acts as the Data Processor. The Processor processes personal data solely on behalf of and in accordance with the documented instructions of the Controller, as set out in this DPA and the Agreement.

2.3 Joint Processing Exclusion

This DPA does not create a joint controller relationship. Each party retains its independent role and obligations under Data Protection Laws.

---

3. Subject Matter and Duration of Processing

3.1 Subject Matter

The processing concerns the provision of the CRM SaaS platform as described in the Agreement, including lead management, client management, WhatsApp messaging, AI-powered analysis, email integration, and related features.

3.2 Duration

Processing shall commence on the date the Controller first accesses or uses the Service and shall continue for the duration of the Agreement. Upon termination, processing shall cease subject to the data return and deletion provisions in Section 14 of this DPA.

---

4. Nature and Purpose of Processing

The Processor processes personal data for the following purposes, strictly as instructed by the Controller:

| Purpose | Description | |---------|-------------| | CRM Operations | Storage, organization, retrieval, and management of lead and client records, including contact details, interaction history, and pipeline status | | WhatsApp Messaging | Sending and receiving messages via WhatsApp Business Cloud API on behalf of the Controller, including template messages, session messages, and media | | AI Analysis | Processing conversation content and lead data through Google Gemini Enterprise API for intent analysis, lead extraction, response suggestions, and conversation summarization | | Lead Management | Automated and manual processing of lead data through pipeline stages, assignment, qualification, and conversion workflows | | Email Integration | Processing inbound and outbound email communications, including Gmail import and rule-based lead creation | | Analytics and Reporting | Aggregation and analysis of CRM data to generate reports, dashboards, and performance metrics for the Controller | | User Authentication | Processing user account data for authentication, authorization, and session management | | Billing and Subscription | Processing subscription and payment-related data through Stripe for billing purposes |

---

5. Types of Personal Data Processed

The following categories of personal data may be processed through the Service:

5.1 Contact Information

• Full name, email address, phone number (including international and WhatsApp formats)
• Business name, job title, company address
• Social media identifiers (where imported by the Controller)

5.2 Communication Content

• WhatsApp message content (text, media, interactive elements)
• Email content (subject lines, body text, attachments)
• Internal notes and comments added by the Controller's team
• AI-generated summaries and suggested responses

5.3 Behavioral Data

• Interaction history and activity timelines
• Pipeline stage transitions and qualification data
• Communication preferences and opt-in/opt-out status
• Engagement metrics (message read status, response times)

5.4 Financial Data

• Subscription plan and billing cycle information
• Payment transaction history (processed by Stripe; credit card numbers are NOT stored by the Processor)
• Invoice and refund records

5.5 Technical Data

• IP addresses, browser type, device identifiers
• Session tokens and authentication logs
• API usage and audit trail data

---

6. Categories of Data Subjects

Personal data processed under this DPA may relate to the following categories of data subjects:

| Category | Description | |----------|-------------| | Leads | Prospective customers whose contact information and communication history are managed through the Service | | Clients | Existing customers of the Controller whose business relationship data is stored in the Service | | End Users | Individuals who communicate with the Controller via WhatsApp or email through the Service | | Employees / Team Members | The Controller's employees, agents, and team members who have accounts on the Service |

---

7. Controller Obligations

The Controller shall:

1. Lawful Processing - Ensure that there is a valid legal basis under Article 6 of the GDPR for all personal data processed through the Service
2. Data Subject Notices - Provide appropriate privacy notices to data subjects informing them of the processing, including the involvement of the Processor and any sub-processors
3. Data Accuracy - Ensure that personal data provided to the Processor is accurate and up to date
4. Instructions - Provide documented, lawful processing instructions to the Processor and ensure that the processing described in this DPA is consistent with applicable Data Protection Laws
5. Consent Management - Where processing is based on consent, obtain, record, and manage data subject consent in compliance with GDPR Article 7
6. Data Protection Impact Assessments - Conduct Data Protection Impact Assessments (DPIAs) where required under Article 35 of the GDPR
7. Notification - Inform the Processor without undue delay if it becomes aware of any circumstances that may affect the Processor's ability to comply with this DPA
8. Compliance - Comply with all obligations incumbent on it under Data Protection Laws

---

8. Processor Obligations

In accordance with Article 28(3) of the GDPR, the Processor shall:

8.1 Documented Instructions

• Process personal data only on documented instructions from the Controller, including with regard to transfers of personal data to a third country or an international organization, unless required to do so by European Union or Member State law to which the Processor is subject
• Immediately inform the Controller if, in the Processor's opinion, an instruction infringes the GDPR or other applicable Data Protection Laws

8.2 Confidentiality

• Ensure that persons authorized to process the personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality
• Limit access to personal data to personnel who require such access to perform their obligations under the Agreement

8.3 Security

• Implement and maintain appropriate technical and organizational measures to ensure a level of security appropriate to the risk of processing, as described in Annex 2 (Technical and Organizational Measures)
• Take into account the state of the art, the costs of implementation, and the nature, scope, context, and purposes of processing, as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons

8.4 Sub-Processor Engagement

• Not engage another processor (sub-processor) without prior specific or general written authorization of the Controller, as detailed in Section 9 of this DPA
• Where sub-processors are engaged, impose the same data protection obligations as set out in this DPA by way of a contract or other legal act under European Union or Member State law

8.5 Data Subject Rights Assistance

• Assist the Controller by appropriate technical and organizational measures, insofar as this is possible, for the fulfillment of the Controller's obligation to respond to requests for exercising the data subject's rights under Chapter III of the GDPR (Articles 15-22)
• Promptly notify the Controller of any data subject request received directly by the Processor

8.6 Security and Breach Assistance

• Assist the Controller in ensuring compliance with the obligations pursuant to Articles 32 to 36 of the GDPR, taking into account the nature of processing and the information available to the Processor
• Notify the Controller of any Personal Data Breach as detailed in Section 10 of this DPA

8.7 Deletion and Return

• At the choice of the Controller, delete or return all personal data to the Controller after the end of the provision of services relating to processing, and delete existing copies unless European Union or Member State law requires storage of the personal data, as detailed in Section 14 of this DPA

8.8 Audit and Demonstration

• Make available to the Controller all information necessary to demonstrate compliance with the obligations laid down in Article 28 of the GDPR
• Allow for and contribute to audits, including inspections, conducted by the Controller or another auditor mandated by the Controller, as detailed in Section 12 of this DPA

---

9. Sub-Processor Management

9.1 Current Sub-Processors

The Controller hereby grants general written authorization for the Processor to engage the following sub-processors:

| Sub-Processor | Location | Purpose | Data Processed | |---------------|----------|---------|----------------| | Supabase Inc. | United States | Database hosting, authentication, and real-time data services | All CRM data, user accounts, authentication tokens | | Meta Platforms / WhatsApp | United States / EU | WhatsApp Business Cloud API messaging services | WhatsApp messages, phone numbers, conversation metadata | | Google (Gemini Enterprise API) | United States | AI-powered conversation analysis, lead extraction, and response generation | Conversation content, lead data submitted for AI processing | | Stripe Inc. | United States | Payment processing, subscription management, and billing | Payment information, subscription data, billing history | | Sentry (Functional Software Inc.) | United States | Application error monitoring and performance tracking | Error logs, stack traces (may include anonymized user context) | | Vercel Inc. | United States | Application hosting, deployment, and content delivery | Application code, server-side rendered content, access logs |

9.2 Prior Written Consent for New Sub-Processors

• The Processor shall inform the Controller of any intended changes concerning the addition or replacement of sub-processors, giving the Controller the opportunity to object to such changes
• Notification of new sub-processors shall be provided via email to the Controller's registered email address at least 30 days before the new sub-processor begins processing personal data

9.3 Objection to New Sub-Processors

• The Controller may object to a new sub-processor by notifying the Processor in writing within 30 days of receiving notification
• If the Controller objects on reasonable grounds relating to data protection, the Processor shall make reasonable efforts to:
  • Make available an alternative sub-processor, or
  • Recommend changes to the Service that would avoid the use of the objected-to sub-processor
• If the Processor cannot reasonably accommodate the objection, either party may terminate the affected portion of the Service by providing written notice. The Processor will provide the Controller with a pro-rata refund of any prepaid fees for the terminated portion of the Service

9.4 Sub-Processor Liability

• The Processor shall remain fully liable to the Controller for the performance of each sub-processor's obligations under this DPA
• Where a sub-processor fails to fulfill its data protection obligations, the Processor shall remain responsible to the Controller for the performance of that sub-processor's obligations
• The Processor shall enter into a written agreement with each sub-processor imposing data protection obligations no less protective than those set out in this DPA

Exclusive Remedy: The Controller's sole and exclusive remedy for sub-processor failures shall be a claim against the Processor (not directly against the sub-processor). The Processor shall pursue remedies against the sub-processor on the Controller's behalf where appropriate. The Processor's aggregate liability for sub-processor failures is subject to the liability limitations in the Agreement (Terms of Service), except for liability arising from the Processor's failure to conduct adequate due diligence on the sub-processor or failure to impose contractually equivalent data protection obligations.

---

10. Personal Data Breach Notification

10.1 Notification to Controller

• The Processor shall notify the Controller without undue delay and in any event within 48 hours after becoming aware of a Personal Data Breach affecting the Controller's personal data
• Notification shall be sent to the Controller's registered email address and, where available, through the Service's notification system

10.2 Notification Content

The breach notification shall include, at minimum:

1. A description of the nature of the Personal Data Breach, including where possible the categories and approximate number of data subjects concerned and the categories and approximate number of personal data records concerned
2. The name and contact details of the Processor's data protection officer or other contact point where more information can be obtained
3. A description of the likely consequences of the Personal Data Breach
4. A description of the measures taken or proposed to be taken to address the Personal Data Breach, including measures to mitigate its possible adverse effects

10.3 Ongoing Obligations

• Where it is not possible to provide all information at the same time, the information may be provided in phases without undue further delay
• The Processor shall cooperate with and assist the Controller in investigating and remediating the breach
• The Processor shall document all Personal Data Breaches, including the facts relating to the breach, its effects, and the remedial action taken
• The Processor shall assist the Controller in meeting its obligations under Articles 33 and 34 of the GDPR (notification to supervisory authority and communication to data subjects)

---

11. Data Subject Rights Assistance

11.1 Scope of Assistance

The Processor shall assist the Controller in responding to data subject requests exercising their rights under GDPR Chapter III, including:

• Right of access (Article 15)
• Right to rectification (Article 16)
• Right to erasure ("right to be forgotten") (Article 17)
• Right to restriction of processing (Article 18)
• Right to data portability (Article 20)
• Right to object (Article 21)
• Rights related to automated decision-making and profiling (Article 22)

11.2 Direct Requests

• If the Processor receives a request directly from a data subject, the Processor shall promptly redirect the data subject to the Controller and notify the Controller of the request
• The Processor shall not respond to a data subject request directly unless instructed by the Controller or required by applicable law

11.3 Technical Facilitation

The Service provides the following features to assist Controllers in fulfilling data subject rights:

• Data export - Export lead and client records in standard formats (CSV, JSON)
• Data deletion - Delete individual records and associated data
• Data rectification - Edit and update personal data records
• Access logs - Audit trail of data access and modifications

---

12. Audit Rights

12.1 Information Access

The Processor shall make available to the Controller all information necessary to demonstrate compliance with the obligations laid down in this DPA and Article 28 of the GDPR.

12.2 Audit Procedure

• The Controller or a qualified third-party auditor appointed by the Controller may conduct an audit of the Processor's compliance with this DPA
• Audits shall be conducted with reasonable prior written notice of at least 30 calendar days
• Audits shall be limited to once per calendar year, unless a Personal Data Breach has occurred or a supervisory authority requires an additional audit
• Audits shall be conducted during normal business hours and in a manner that minimizes disruption to the Processor's operations

12.3 Confidentiality

• The Controller and its auditors shall treat all information obtained during the audit as confidential
• Auditors must enter into appropriate non-disclosure agreements before accessing Processor premises or systems
• Audit scope shall not extend to data or systems of other Controller tenants

12.4 Costs

• The Controller shall bear the costs of any audit it initiates
• If an audit reveals material non-compliance by the Processor, the Processor shall bear the reasonable costs of the audit and shall promptly remediate the non-compliance at its own expense

12.5 Alternative Audit Mechanisms

The Processor may satisfy audit requests by providing:

• Relevant third-party certifications or audit reports (e.g., SOC 2 reports from sub-processors)
• Completed security questionnaires
• Documentation of technical and organizational measures
• Results of penetration testing or vulnerability assessments (summary form)

---

13. International Data Transfers

13.1 Transfer Mechanisms

Where personal data is transferred from the European Economic Area (EEA) to countries that have not received an adequacy decision from the European Commission, the Processor shall ensure that appropriate safeguards are in place, including:

• Standard Contractual Clauses (SCCs) - The parties agree to be bound by the Standard Contractual Clauses adopted by the European Commission pursuant to Decision (EU) 2021/914, which are incorporated by reference into this DPA
• Module Two (Controller to Processor) of the SCCs shall apply to transfers from the Controller to the Processor
• Module Three (Processor to Sub-Processor) of the SCCs shall apply to onward transfers from the Processor to sub-processors

13.2 Transfer Impact Assessments

• The Processor shall conduct Transfer Impact Assessments (TIAs) for each sub-processor located outside the EEA to evaluate whether the legal framework in the recipient country provides adequate protection for personal data
• TIAs shall take into account the laws and practices of the recipient country, including government access to data, and shall be updated when circumstances change materially
• The results of TIAs shall be made available to the Controller upon request

13.3 Supplementary Measures

Where a TIA indicates that SCCs alone do not provide sufficient protection, the Processor shall implement supplementary measures, which may include:

• Technical measures - Encryption of data in transit and at rest, pseudonymization, access controls
• Organizational measures - Internal policies restricting data access, staff training, confidentiality agreements
• Contractual measures - Additional commitments from sub-processors regarding government data access requests

13.4 US Data Transfers

Several sub-processors are located in the United States. The Processor relies on the following mechanisms for US transfers:

• Standard Contractual Clauses (Module Three) with each US-based sub-processor
• Supplementary technical measures (encryption, access controls, data minimization)
• Assessment of US surveillance laws and their applicability to the specific processing activities

Post-Schrems II Supplementary Measures: In accordance with the CJEU judgment in Case C-311/18 (Data Protection Commissioner v. Facebook Ireland and Maximillian Schrems, July 16, 2020) and EDPB Recommendations 01/2020, the Processor implements the following supplementary technical measures for transfers to the United States:

• Encryption in transit: TLS 1.3 for all data transfers; certificate pinning where supported
• Encryption at rest: AES-256 encryption for all stored Personal Data
• Access controls: Multi-tenant Row-Level Security ensuring logical separation of Controller data
• Pseudonymization: Where technically feasible, personal identifiers are pseudonymized before transfer
• Minimal access: Sub-processors receive only the minimum data necessary for their specific processing purpose

The Processor acknowledges that these supplementary measures may not prevent lawful access requests by US governmental authorities under FISA Section 702 or Executive Order 12333. The EU-US Data Privacy Framework (DPF) adequacy decision of July 10, 2023 currently provides a legal basis for US transfers, but the Processor monitors developments and will notify the Controller within thirty (30) days if the DPF adequacy decision is invalidated or materially altered.

---

14. Data Return and Deletion

14.1 During the Agreement

The Controller may export personal data from the Service at any time using the data export functionality provided (CSV, JSON formats).

14.2 Upon Termination

Upon termination or expiration of the Agreement:

1. Export Window - The Controller shall have 30 calendar days from the effective date of termination to export all personal data from the Service
2. Processor Assistance - The Processor shall provide reasonable assistance to the Controller in exporting data during the export window at no additional charge
3. Deletion - After the 30-day export window, the Processor shall delete all personal data processed on behalf of the Controller from its systems, including all copies, backups, and archived data, within 90 calendar days unless:
   • European Union or Member State law requires continued storage
   • The data is subject to an ongoing legal hold or investigation
   • The data is necessary to resolve a pending dispute

14.3 Certification of Deletion

• Upon written request, the Processor shall provide written certification confirming that all personal data has been deleted in accordance with this section
• Certification shall include confirmation that data has been deleted from active systems, backup systems, and sub-processor systems

14.4 Backup Retention

• Automated backup systems may retain copies of personal data for up to 90 days after deletion from active systems
• Backups are encrypted and access-restricted, and data within backups will not be actively processed
• The Processor shall ensure complete deletion from backup systems within the timeframe specified above

---

15. Liability and Indemnification

15.1 Processor Liability

The Processor shall be liable for damages caused by processing that does not comply with the obligations of the GDPR specifically directed to processors, or where the Processor has acted outside of or contrary to the Controller's lawful instructions.

15.2 Controller Liability

The Controller shall be liable for damages caused by processing that does not comply with the GDPR, including where the Controller has provided unlawful instructions to the Processor.

15.3 Liability Limitations

• Each party's aggregate liability under this DPA shall be subject to the liability limitations set out in the Agreement (Terms of Service), except that nothing in this DPA shall limit either party's liability for:
  • Breaches of confidentiality obligations
  • Intentional or grossly negligent breaches of this DPA
  • Fines or penalties imposed by supervisory authorities to the extent caused by the liable party's breach

15.4 Indemnification

• Each party shall indemnify and hold harmless the other party from and against any losses, damages, claims, costs, and expenses (including reasonable legal fees) arising from the indemnifying party's breach of this DPA or applicable Data Protection Laws
• The indemnifying party's obligation is conditional upon the indemnified party providing prompt written notice of the claim, reasonable cooperation in the defense, and sole control of the defense and settlement

---

16. Term, Termination, and Survival

16.1 Term

This DPA shall remain in effect for the duration of the Agreement between the parties. It shall automatically terminate upon termination or expiration of the Agreement, subject to the survival provisions below.

16.2 Termination for Breach

Either party may terminate this DPA immediately upon written notice if the other party materially breaches this DPA and fails to cure such breach within 30 calendar days of receiving written notice specifying the breach.

16.3 Survival

The following provisions shall survive termination or expiration of this DPA:

• Section 10 (Personal Data Breach Notification) - for any breaches discovered post-termination
• Section 12 (Audit Rights) - for 12 months following termination
• Section 14 (Data Return and Deletion) - until all data has been deleted or returned
• Section 15 (Liability and Indemnification) - indefinitely
• Annex 2 (Technical and Organizational Measures) - until all data has been deleted

---

17. Amendments

17.1 Modification

This DPA may be amended only by a written instrument signed or electronically accepted by both parties, except that:

• The Processor may update the list of sub-processors in accordance with the procedure in Section 9
• The Processor may update the Technical and Organizational Measures (Annex 2) to maintain or improve the security posture, provided the overall level of protection is not diminished

17.2 Regulatory Changes

If changes to Data Protection Laws require modifications to this DPA, the Processor shall notify the Controller and propose appropriate amendments. The parties shall negotiate in good faith to agree on necessary changes within a reasonable timeframe.

---

18. Governing Law and Jurisdiction

18.1 Governing Law

This DPA shall be governed by and construed in accordance with the laws of Romania, without regard to its conflict of laws principles. Where the GDPR applies, it shall take precedence over conflicting provisions of Romanian national law.

18.2 Jurisdiction

Any disputes arising from or in connection with this DPA shall be subject to the exclusive jurisdiction of the competent courts of București, Romania, without prejudice to the rights of data subjects to lodge complaints with their local supervisory authority or courts under GDPR Articles 77-79.

18.3 Supervisory Authority

The lead supervisory authority for the Processor is the ANSPDCP (Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal), Romania.

---

19. Miscellaneous

19.1 Entire Agreement

This DPA, together with the Agreement and its annexes, constitutes the entire agreement between the parties regarding the processing of personal data and supersedes all prior agreements, representations, and understandings.

19.2 Severability

If any provision of this DPA is found to be invalid or unenforceable, the remaining provisions shall continue in full force and effect. The invalid provision shall be replaced with a valid provision that achieves the original intent to the greatest extent possible.

19.3 Precedence

In the event of a conflict between this DPA and the Agreement, this DPA shall prevail with respect to the processing of personal data. In the event of a conflict between this DPA and the Standard Contractual Clauses, the Standard Contractual Clauses shall prevail.

19.4 No Third-Party Beneficiaries

This DPA does not confer any rights on any third party, except that data subjects may enforce their rights under the GDPR and the Standard Contractual Clauses as third-party beneficiaries where applicable.

---

Annex 1: Details of Processing

| Element | Description | |---------|-------------| | Subject Matter | Provision of CRM SaaS platform services | | Duration | For the term of the Agreement between Controller and Processor | | Nature of Processing | Collection, storage, organization, retrieval, consultation, use, disclosure by transmission, alignment, combination, restriction, erasure, and destruction | | Purpose | CRM operations, WhatsApp messaging, AI analysis, lead/client management, email integration, analytics, authentication, and billing | | Types of Personal Data | Contact information, communication content, behavioral data, financial data, technical data (see Section 5) | | Categories of Data Subjects | Leads, clients, end users, employees/team members of the Controller (see Section 6) | | Applicable Competent Supervisory Authority | ANSPDCP, Romania |

---

Annex 2: Technical and Organizational Measures (TOMs)

The Processor implements the following technical and organizational measures to protect personal data:

A. Encryption

| Measure | Implementation | |---------|---------------| | Encryption at rest | AES-256 encryption for all stored personal data, including database records and file storage (provided by Supabase infrastructure) | | Encryption in transit | TLS 1.3 for all data transmitted between the Service, users, and sub-processors | | Key management | Encryption keys are managed by the infrastructure provider (Supabase/AWS) with regular key rotation | | Backup encryption | All backup data is encrypted using the same standards as production data |

B. Access Control

| Measure | Implementation | |---------|---------------| | Row-Level Security (RLS) | PostgreSQL Row-Level Security policies enforce data isolation at the database level, ensuring each organization can only access its own data | | Role-Based Access Control (RBAC) | Four-tier permission model (Owner, Admin, Agent, Viewer) with granular resource-level permissions | | Authentication | Secure authentication via Supabase Auth with support for email/password and social login providers | | Session management | JWT-based session tokens with configurable expiration and secure cookie handling | | Least privilege | Access to personal data is restricted to personnel who require it for their specific role |

C. Multi-Tenant Isolation

| Measure | Implementation | |---------|---------------| | Database-level isolation | RLS policies on all tables containing personal data, keyed on organization_id | | Application-level isolation | Middleware and server-side checks enforce tenant boundaries on every request | | API isolation | All API endpoints validate organization membership before processing requests | | No cross-tenant access | Architectural design prevents any organization from accessing another's data |

D. Backup and Disaster Recovery

| Measure | Implementation | |---------|---------------| | Automated backups | Daily automated backups of all data with point-in-time recovery capability | | Geographic redundancy | Backups stored in geographically separate locations from primary data | | Recovery testing | Regular testing of backup restoration procedures | | Retention | Backup retention in accordance with the data retention policy, with deletion upon Controller request or termination |

E. Employee Confidentiality

| Measure | Implementation | |---------|---------------| | Confidentiality agreements | All personnel with access to personal data are bound by confidentiality obligations | | Background checks | Conducted in accordance with applicable law for personnel handling personal data | | Training | Regular data protection and security awareness training for all relevant personnel | | Access revocation | Immediate revocation of access upon termination of employment or change of role |

F. Incident Response

| Measure | Implementation | |---------|---------------| | Detection | Automated monitoring and alerting systems for security incidents (Sentry error monitoring, application-level logging) | | Response plan | Documented incident response procedures with defined roles and escalation paths | | Notification | Breach notification to Controllers within 48 hours of becoming aware of a Personal Data Breach | | Post-incident review | Root cause analysis and remediation following all security incidents | | Documentation | All incidents documented with timeline, impact assessment, and remediation actions |

G. Application Security

| Measure | Implementation | |---------|---------------| | Secure development | Security-focused development practices including code review and automated security scanning | | Input validation | Server-side validation of all user inputs using Zod schemas to prevent injection attacks | | Dependency management | Regular monitoring and updating of third-party dependencies for known vulnerabilities | | Error handling | Structured error handling that prevents exposure of sensitive information in error messages | | Rate limiting | API rate limiting to prevent abuse and protect against denial-of-service attempts |

H. Network Security

| Measure | Implementation | |---------|---------------| | HTTPS only | All connections to the Service require HTTPS; HTTP requests are redirected | | CORS policy | Strict Cross-Origin Resource Sharing policy limiting API access to authorized origins | | Webhook security | HMAC signature verification for all inbound webhooks (WhatsApp, Stripe, Gmail) | | DDoS protection | Distributed denial-of-service protection provided by the hosting infrastructure (Vercel) |

---

Annex 3: Standard Contractual Clauses

The Standard Contractual Clauses adopted by the European Commission pursuant to Implementing Decision (EU) 2021/914 of 4 June 2021 are incorporated by reference into this DPA for international transfers of personal data to sub-processors in countries without an adequacy decision.

• Module Two (Controller to Processor) applies to transfers from the Controller (EEA) to the Processor
• Module Three (Processor to Sub-Processor) applies to onward transfers from the Processor to sub-processors outside the EEA
• Governing law of the SCCs: The law of Romania (Clause 17, Option 1)
• Dispute resolution forum: The courts of București, Romania (Clause 18)
• Competent supervisory authority: ANSPDCP, Romania (Clause 13)

The full text of the SCCs is available from the European Commission at EUR-Lex and is deemed incorporated in its entirety.

---

Contact

For questions about this Data Processing Agreement, contact:

CMG FRAMEWORKS SRL Drumul NISIPOASA, Nr. 46-52, Lot 1/2, Bl. C, Scara C7, Etaj P, Ap. 3 București, Romania

• Data Protection Officer: dpo@cmgworkflow.com
• General inquiries: support@cmgworkflow.com
• Phone: +40 772 125 155

---

This Data Processing Agreement is effective as of February 24, 2026.